IconVault's CLAUDE.md Scanner audits your agent instruction files for leaked secrets, dangerous commands and overly permissive rules, all with hand-written heuristic pattern checks. Paste your CLAUDE.md or load a .md file, hit scan, and get a 0-100 safety score with a grade, plus every finding listed by severity, line number and fix advice.

It catches real mistakes fast: AWS keys, GitHub tokens and API keys left in configs, curl piped to bash, rm -rf instructions, blanket sudo or never ask for confirmation rules, and classic prompt-injection phrases. Everything is free and runs fully in your browser, so your config never leaves your device. Note this is a first pass, not a full security audit.